We don't track deleted accounts, but we do track deleted groups, users added to high-privilege groups and other things through this exact method. It is quite easy to write the MOM/Ops Manager rules to do this collection and reporting.
Malcolm From: James Rankin [mailto:[EMAIL PROTECTED] Sent: Wednesday, 05 November, 2008 08:43 To: NT System Admin Issues Subject: Re: How to monitor deletion of user accounts You could configure an Operations Manager rule to collect these events up for you, if you used it. 2008/11/5 Thomas Mullins <[EMAIL PROTECTED]> Any thoughts on how to monitor the deletion of user accounts? I know to look for event code 630 in the security log, but this gets cumbersome across multiple domain controllers. I was thinking about trying to have the DC's log this information to a Cisco Mars box. If anyone has any info to share, it would be greatly appreciated. Thanks Shane ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ This e-mail, including any attached files, may contain confidential and privileged information for the sole use of the intended recipient. Any review, use, distribution, or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
